IHSC Dental Digital Radiography Contract_SOW_FY25_09.16.2024.docx

U.S. Immigration and Customs Enforcement (ICE) ICE Health Service Corps (IHSC)

Dental Digital Radiography Support Services

Statement of Work (SOW)

Office of the Chief Information Officer (OCIO)

August 2024 Washington, DC

Table of Contents

Department of Homeland Security (DHS) Immigration and Customs Enforcement (ICE) ICE Health Service Corps (IHSC) FY 2025 IHSC Dental Digital Radiography: Support Services Statement of Work

1.0 GENERAL

1.1 Background

The Immigration and Customs Enforcement Health Service Corps (IHSC, formerly the Division of Immigration Health Services or DIHS) provides or arranges for health care services for undocumented immigrants detained by the U.S. Immigration and Customs Enforcement (ICE). As ICE’s medical authority, IHSC provides health care delivery and oversight to individuals in ICE custody who may be housed in service processing centers (SPC), Contract Detention Facilities (CDF), or State, county, or local inter-governmental service agreement (IGSA) correctional facilities located throughout the continental United States.

1.2 Scope/Objective

The vendor shall provide support services to the dental digital image sensors and Medicor Imaging Picture Archiving and Communication System (MiPACS) Dental Enterprise Solution, a centralized multi-clinic platform for 14 IHSC dental clinics (see attachment A). The dental digital image sensors and MiPACs centralized solution must be maintained to meet all specific requirements and tasks described in this statement of work including software, configuration, conversion/migration of existing dental images, installation, training, and support. All applicable state and federal laws and regulations must be followed.

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 Task One – MiPACS Image Viewer System, Software, and Centralized Platform Support The vendor shall support the MiPACs software for dental image capture, storage, and centralized access to all images from any IHSC dental workstations across the nation regardless of the capture location.

Support of the MiPACS image viewer system, software, and centralized platform services shall include:

· Ability to support multiple locations with physical or virtual servers (hosted in the government cloud) with redundant backup and capacity to operate on low bandwidth.

· Allow local cache of images for faster review times within the 14 IHSC dental clinics.

· Multi-database configuration for viewing outside of the 14 IHSC dental clinics.

· Ability to interface with IHSC’s selected electronic health record (EHR) system and any future changes that occur to the current EHR.

· Image manipulation, enhancement, and analysis tools such as brightness, contrast, histogram adjustment, rotation, inversion, equalization, sharpening, noise reduction, zoom, etc.

· Ability to import multiple DICOM-compliant dental image file types within ICE database architecture (e.g., SQL).

· Ability to import/export images securely using DICOM protocol to exchange images.

· Ability to retrieve IHSC dental and medical images securely using DICOM protocol to the MiPACS Storage Server from a cloud repository using MiPACS as the viewer.

· User-security controls to ensure only the appropriate users can capture, delete, edit, print, export, import, etc.

· Interoperability with a wide range of dental imaging hardware (intraoral x-ray sensors, panoramic machines, and intraoral cameras); bridging solutions as needed to support any future hardware.

The vendor shall provide:

· All necessary software, viewers, interfaces, and licenses to operate the MiPACS system including pre-production testing and final implementation.

· Transferable software licenses with no expiration (e.g., can transfer software to a new computer or new server, if the hardware is upgraded or in the event of site closure, can transfer licenses/software to another IHSC site).

· Access to all software for ICE Information Technology (IT) Operations Division in situations where re-installation is necessary.

· Timely software updates and enhancements at no additional charge including any necessary future security patches to prevent vulnerability of the ICE network (e.g., must use the latest version of MSXML with updates as needed to keep pace with ICE security requirements). Updates shall be provided with minimal downtime (less than 1 business day).

· Unlimited phone support with less than a 15-minute wait time during business hours and with less than an 18-hour response time during after-hours; one primary IT POC assigned to IHSC for continuity of support. Ensure an alternate IT POC is available during any business day in the absence of the primary IT POC. The name, contact information, and qualifications of the primary IT POC and any alternate IT POC, who shall act in the absence of the IT POC, shall be provided in a biographical sketch, or resume attachment.

· Technical resources to support restoring the system to full operating capability in the event of an outage incident.

· The Contractor shall develop a Communication Plan, for review and approval by the Government, addressing communications between the IT POC and alternate IT POC staff with the end user community during an incident. For each incident, the Contractor shall perform analysis, develop after-action reports, and revise troubleshooting scripts, as appropriate, to improve the restoration of services within Tier I and Tier II. The Government anticipates ~100 ticket escalations on an annual basis.

· Support for transition and integration with any future electronic health record deployed by ICE including re-installation of software, viewers, interfaces, data migration/conversion as needed including the transition between servers, and transition of vendors at the end of the contract.

· Support of all manufacturer-recommended preventive maintenance procedures.

3.0 OTHER APPLICABLE CONDITIONS

3.1 Period of Performance

Immediately following the award, no later than March 2025, each facility should be informed of the continued operation of the MiPACS Image Viewer System, Software, and Centralized Platform Services and the provision of MiPACS technical support, via the contractor.

The contract period of performance will cover a period of four (4) years in total.

· Base Period is 12 months – 03/14/2025 – 03/13/2026

· Option Period 1 is 12 months – 03/14/2026 – 03/13/2027

· Option Period 2 is 12 months – 03/14/2027 – 03/13/2028

· Option Period 3 is 12 months – 03/14/2028 – 03/13/2029

3.2 Place of Performance

The place(s) of performance shall be within various specifically identified ICE facilities both CONUS and OCONUS, the contractor’s office site, or the contractor’s authorized telework/remote location. Any work completed at a location other than mentioned herewith shall be at the discretion of the Government Contracting Officer (CO) or the Contracting Officer Representative (COR). The Contractor shall obtain written approval (via email) from the CO or COR before the start of any telework arrangement. Attendance is required for meetings via in-person or virtual activities available as scheduled by ICE.

The Contractor must maintain an adequate workforce for the uninterrupted performance of all tasks defined within the (i.e., SOW/SOO/PWS). When hiring personnel, the Contractor shall maintain the stability and continuity of the workforce are essential.

For the list of the IHSC facility locations see Attachment A.

3.3 Hours of Support Services

The Contractor will provide access to the support, Monday through Friday, throughout the primary hours of 6:00 AM – 6:00 PM ET to best accommodate the common business hours of 7:00 AM – 3:30 PM and 8:00 AM – 4:30 PM operated throughout the IHSC facilities across the U.S.

Recognized Federal holidays: Unless required under the terms of the contract or authorized by the contracting authority, the Contractor shall not work on any of the following holidays and the Government observed legal holidays: New Year’s Day, Martin Luther King, Jr. Birthday, Washington’s Birthday, Memorial Day, Juneteenth National Independence Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, and Christmas Day.

3.4 Disclosure of Information

Information furnished by the contractor under this contract may be subject to disclosure under the Freedom of Information Act (FOIA). Therefore, all items that are confidential to the business, or contain trade secrets, proprietary, or personally identifiable information must be clearly, marked. Any information made available to the contractor by the Government must be used only for the purpose of carrying out the requirements of this contract and must not be divulged or made known, in any manner to any person except as may be necessary in the performance of the contract.

3.5 Advertisements, Publicizing Awards, and News Releases

All press releases or announcements about agency programs, projects, and contract awards need to be cleared by the Program Office and the Contracting Officer. Under no circumstances shall the Contractor, or anyone acting on behalf of the Contractor, refer to the supplies, services, or equipment furnished under the provisions of this contract in any publicity news release or commercial advertising without first obtaining explicit written consent to do so from the Program Office and the Contracting Officer.

3.6 General Report Requirements

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with DHS workstations (Windows and Microsoft Office Applications).

3.7 Section 508 Compliance

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable EIT accessibility standards have been identified:

36 Code of Federal Regulations (CFR) 1194.21 Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web-based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, or uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous JavaScript and XML (AJAX) then 1194.21 Software standards also apply to fulfill functional performance criteria.

36 CFR 1194.41 Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required 1194.31 Functional Performance Criteria, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum. In addition, any help or support provided in this work statement that offers telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

3.7.1 Section 508 Applicable Exceptions

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the assigned Contracting Officer’s Representative (COR) and a determination will be made in accordance with DHS Management Directives (MD) 4010.2. DHS has identified the following exceptions that may apply: 36 CFR 1194.3(b) Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service, or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for this requirement, are not considered members of the public.

3.7.2 Section 508 Compliance Requirements

36 CFR 1194.2(b) (COTS/GOTS products), When procuring a product, each agency shall procure products that comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meet some but not all of the standards, the agency must procure the product that best meets the standards. When applying this standard, all procurements of EIT shall have documentation of market research that identifies a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DHS Office of Accessible Systems and Technology (OAST) in accordance with DHS MD 4010.2.

All tasks for testing functional and/or technical requirements must include specific testing for Section 508 compliance and must use DHS Office of Accessible Systems and Technology-approved testing methods and tools. For information about approved testing methods and tools send an email to accessibility@dhs.gov.

3.7.3 Section 508 Requirements

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018, and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

3.7.4 Section 508 Requirements for Technology Services

a. When providing maintenance upgrades, substitutions, and replacements to ICT, the contractor shall not reduce the original ICT’s level of Section 508 conformance prior to upgrade, substitution, or replacement. The agency reserves the right to request an Accessibility Conformance Report (ACR) for proposed upgrades, substitutions, and replacements prior to acceptance. The ACR should be created using the Voluntary Product Accessibility Template Version 2.2 508 (or successor versions). The template can be located at https://www.itic.org/policy/accessibility/vpat

b. Contractor personnel shall possess the knowledge, skills, and abilities necessary to address the accessibility requirements in this work statement.

3.8 ICE Security Requirements

The Contractor or Vendor shall be responsible for IT security for all systems connected to a DHS network or operated by the Contractor for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Contractor must have physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency’s mission.

The Contractor shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure the appropriate security of IT resources that are developed, processed, or used under this contract.

Within 10 business days after the contract purchase order award, the contractor shall submit for approval its IT Security Plan, which shall be consistent with and further detail the approach contained in the offeror's proposal. The plan, as approved by the Contracting Officer (CO), shall be incorporated into the contract as a compliance document.

The Contractor’s IT Security Plan shall comply with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.); the Government Information Security Reform Act of 2000; and the FISMA of 2002; and with Federal policies and procedures that include, but are not limited to, OMB Circular A-130.

The security plan shall specifically include instructions regarding handling and protecting sensitive information at the Contractor’s site (including any information stored, processed, or transmitted using the Contractor’s computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

OMB M-06-16, Protection of Sensitive Agency Information requires that agencies protect PII that is physically removed from Department locations or is accessed remotely. Physical removal includes both removable media and media in mobile devices (e.g., laptop hard drives). Refer to the following documents for additional information and policies on protecting PII and Sensitive PII at DHS:

DHS 4300A ITSSP SS Policy Directive v13.3.pdf

3.8.1 Contractor IT Security Accreditation

Within six (6) months after the contract, the contractor shall submit written proof of IT Security accreditation to DHS for approval by DHS CO. Accreditation will proceed according to the criteria of DHS Sensitive System Policy Publication, DHS 4300A ITSSP SS Policy Directive v13.3.pdf or any replacement publication, which the CO will provide upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the CO, shall be incorporated into the contract as a compliance document. The contractor/vendor shall comply with the approved DHS ICE accreditation documentation and Authority to Operate process.

3.8.2 Vulnerability & Compliance Overview

3.8.2.1 Vulnerability Scanning

The three techniques are agent-based, agentless scanning, and passive network monitoring. Authenticated scans allow for the scanner to directly access network-based assets using remote administrative protocols such as secure shell (SSH) or remote desktop protocol (RDP) and authenticate using provided system credentials. This allows the vulnerability scanner to access low-level data, such as specific services and configuration details of the host operating system. It's then able to provide detailed and accurate information about the operating system and installed software, including configuration issues and missing security patches. The contractor/vendor shall provide the raw scans and report every month.

Common Vulnerabilities and Exposures is a glossary that classifies vulnerabilities by analyzing vulnerabilities and then uses the Common Vulnerability Scoring System (CVSS) to evaluate the threat level of a vulnerability. A CVE score is often used for prioritizing the security of vulnerabilities. (Critical, High, Moderate & Low) The Contractor/Vendor shall address any all vulnerabilities as such Critical (15 days), High (30 days), Moderate (90 days) & Low (within a 12-month period). If a Zero-day exploit is identified the contractor/vendor shall follow DHS ICE direction for remediation and reporting.

3.8.2.2 Security Impact Analysis (SIA)

The Security Impact Analysis is a process to determine the effect(s) a proposed change can cause on the security posture of a FISMA system. Conducting a SIA is a mandatory process for all changes. Per NIST 800-53 CM-4 Security Impact Analysis the contractor/vendor will complete and analyze changes to the information system to determine potential security and privacy impacts prior to change implementation and send the report back to ICE Security. The depth and intensity of an SIA (along with associated documentation) varies directly with the scope of a proposed change. The SIA may require little time, or it may entail a detailed process, with security testing, scans, etc. The key “deliverable” of a SIA is to determine the impact the change can have on a system’s security posture.

3.8.2.3 If the Contractor or Vendor is using Software from the Approved Software List:

Contractors entering into an agreement for services to the Department of Homeland Security (DHS) and Immigration and Customs Enforcement (ICE) and/or its Federal customers shall be contractually subject to all DHS, ICE, and Federal Information Technology (IT) Security standards, policies, and reporting requirements. The contractor shall meet and comply with all DHS and ICE IT Security Policies and all applicable DHS (e.g., DHS 4300A ITSSP SS Policy Directive v13.3.pdf), ICE and NIST standards and guidelines, other Government-wide laws and regulations for protection and security of Information Technology.

3.9 Cloud Computing

All use of cloud computing products or services that process unclassified information must comply with the FedRAMP Authorization Act, 44 U.S.C. Section 3607 et. seq. The following requirements apply when using cloud computing to provide information systems or services in the performance of the contract.

3.9.1 Cloud Computing Security Requirements

a. The Contractor shall implement and maintain administrative, technical, and physical safeguards and controls with the security level and services required in accordance with FedRAMP Security Authorization Requirements unless notified by the Contracting Officer that this requirement has been waived by the Agency's Chief Information Officer.

b. Cloud computing continuous monitoring. The Contractor shall maintain an adequate continuous monitoring capability based on the FedRAMP Security Authorization Requirements including processes described in the NIST Special Publication (SP) 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations and governed by the FedRAMP Continuous Monitoring Strategy Guide.

c. Cloud computing services cyber incident reporting. The Contractor shall report all cybersecurity incidents that are related to the cloud computing service provided under this contract. Reports shall be submitted according to FedRAMP Security Authorization Requirements, published FedRAMP Incident Communications Procedures, and Federal Incident Notification Guidelines for submitting incident notifications to CISA using the CISA incident reporting form (https://us-cert.cisa.gov/report).

4.0 INVOICE AND PAYMENT PROVISIONS

Invoices shall be prepared per Section VII, Contract Clauses; Paragraph A entitled “FAR CLAUSES INCORPORATED BY REFERENCE,” FAR Clause 52.232-25 Prompt Payment, and FAR Clause 52.232-7, Payments under Time and Materials and Labor-Hours.

In addition to invoice preparation as required by the FAR, the Contractor’s invoice shall include the following information:

1) Cover sheet identifying DHS;

2) Task Order Number;

3) Modification Number, if any;

4) DUNS Number;

5) Month services provided

6) Contract Line Item Number (CLIN) and Accounting Classifications

7) ATTN: OCIO-RMD

The contractor shall submit invoices monthly to Invoice.Consolidation@ice.dhs.gov, with the corresponding Contract Line Item Numbers (CLIN), and description for each invoiced item.

Any additional backup information as required by this contract.

The Contractor shall submit the invoice electronically to the addresses below:

E-mail: Invoice.Consolidation@ice.dhs.gov, OCIO-RMD-ServiceCenter@ice.dhs.gov

Simultaneously provide an electronic copy of the invoice to the following individuals at the addresses below:

E-mail: Contracting Officer, Heather Cauthinn at heather.cauthinn@ice.dhs.gov, and Contracting Officer’s Representative (COR), Christopher Lim at christopher.lim@ice.dhs.gov.

The contractor shall submit invoices to the email addresses above. Additionally, the contractor shall prepare and submit a sufficient and procurement regulatory compliant invoice and receiving report for technical certification of inspection/acceptance of services and approval for payment. The contractor shall attach backup information to the invoices and receive reports substantiating all costs for services performed. The receiving agency’s written or electronic acceptance by the COR and date of acceptance shall be included as part of the backup documentation.

If the invoice is submitted without all required backup documentation, the invoice shall be rejected. The Government reserves the right to have all invoices and backup documentation reviewed by the Contracting Officer before payment approval.

5.0 CYBER-SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

5.1 Definitions

i. Component: a unit defined by the supplier that connects to and functions as part of the product. For software products, a component is a unit of software that is defined by a supplier at the time the component is built, packaged, or delivered. For hardware, a component is one hardware unit designed to connect to and function as part of a larger product.

ii. End-of-Life (EOL): means that an ICT product has reached the final stage of the product life cycle in which that version of the ICT product will no longer be supported nor manufactured (e.g., no patches will be developed, no security improvements will be made, and, sometimes, no troubleshooting technical assistance will be offered).

iii. End-of-Support (EOS): means that an ICT product will no longer be supported (e.g., no patches will be developed, no security improvements will be made, and, sometimes, no troubleshooting technical assistance will be offered).

iv. Information and Communications Technology (ICT): encompasses the capture, storage, retrieval, processing, display, representation, presentation, organization, management, security, transfer, and interchange of data and information; includes all categories of ubiquitous technology used for the gathering, storing, transmitting, retrieving, or processing of information (e.g., microelectronics, printed circuit boards, computing systems, software, signal processors, mobile telephony, satellite communications, and networks).

v. Product: part of the equipment (hardware, software, and materials) for which usability is to be specified or evaluated.

5.2 Original Equipment Manufacturer (OEM) End-Use Information and Communications Technology (ICT) Product

i. The contractor shall provide new equipment unless otherwise formally approved by the Government, in writing. The contractor shall provide only Original Manufacturer (OEM) end-use products to the Government. In the event that a shipped OEM product, or part or component of that product, fails, all replacements must be new (i.e., non-refurbished, not previously used) OEM.

ii. The contractor may provide previously used OEM products only with written Government approval. Such parts shall be procured from their original source and shipped only from the manufacturer’s authorized shipment points.

5.3 Accounting of Components in ICT Products

i. The contractor shall provide and maintain a list of components for each product used in the performance of the contract, including through subcontracts or other arrangements. This list for each product shall provide the component manufacturer’s name, address, state, and/or domain of registration, and, where applicable, the Unique Entity Identifier (UEI) number, for all components comprising the ICT products.

ii. The contractor shall notify the Government when a new contractor/subcontractor/service provider is introduced to the ICT provided on this contract, or when suppliers of components or products are changed. If a software component used in the performance of the contract is updated with a new build or release, the contractor must update the list provided in accordance with (i) above to reflect the new version of the software. This includes software builds to integrate an updated component or dependency.

iii. For software products, the contractor shall provide all OEM software updates, and patches to correct defects, for the life of the product [i.e., until the “End of Life” (EoL) or “End of Support” (EoS)]. Software updates and patches shall be made available to the government for all products procured under this Contract and replaced when the End of Support (EoS) is reached.

iv. A contractor using team members in the performance of the contract (e.g., subcontractors or other service providers) shall ensure that the standards for the accounting of components in this subsection are met by team members.

5.4 Supply-Chain Transport

i. The contractor shall use formal, documented, and accountable transit, storage, and delivery procedures (i.e., the possession of the end-use product to be delivered is documented at all times from the initial shipping point to the final destination, and every transfer of the product from one custodian to another is fully documented and accountable) for all information and communication technology (ICT) shipments to fulfill this contract.

ii. The contractor shall maintain all records pertaining to the transit, storage, and delivery of ICT deliverables under this contract through at least 6 months after acceptance and make available for inspection upon request of the Government.

iii. The contractor shall make use of tamper-proof or tamper-evident packaging for all shipments.

iv. The contractor shall provide a packing slip for each container or package with the information identifying the contract or order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number), and the customer point of contact.

v. The contractor shall provide a shipping notification to the intended government recipient; with a copy transmitted to the Contracting Officer, or other designated representative. This shipping notification shall be provided electronically and identify the contract or order number, a description of the hardware/software being shipped (manufacturer name, model number, serial number), initial shipper, shipping date, and identifying (tracking) number.

5.5 Changes to Ownership and Control

The Contractor shall immediately notify the Contracting Officer and Contracting Officer’s Representative (COR) regarding any significant changes to corporate ownership or control from contract award through final delivery or the end of the period of performance. A significant change would be one in which a change occurs in the individuals or entities who, directly or indirectly, either (1) exercises substantial control over an entity, or (2) owns or controls at least 25 percent of the ownership interests of an entity.

6.0 DELIVERABLES

The Contractor shall consider items in BOLD as having mandatory due dates. Items in italics are deliverables or events that must be reviewed and/or approved by the COR before proceeding to the next deliverable or event in this SOW.

& Product Owner

6.1 Kick-Off Meeting

The Contractor shall present a kick-off meeting within five (5) business days after the contract award to include an overview of the project team, scope of work, deliverables, transition activities, communication approach, initial risks, and next steps to immediately initiate support services.

6.2 Transition-In and Transition-Out Plans

6.2.1 Transition-In Plan

The Contractor shall develop and submit a draft Transition-In Plan, in MS Word format, within ten (10) business days after the contract award, to the intended audience, including the Government Information Technology Project Manager(s) (ITPM), Product Owner(s), and the COR. to include a schedule of milestones and events to be submitted in their response to the Transition-In Plan elements listed in this section.

The Contractor shall be responsible for the transition of all technical activities identified in this Contract. The Contractor shall submit a final Transition-in Plan within 10 business days after the contract award reflecting all necessary activities to facilitate the transition of services to the Contractor and the expected completion dates of those activities. All activities must be completed within one (1) month after the kick-off meeting. The following technical activities must be included as part of the Transition-in Plan:

· Inventory and orderly transfer of all hardware, software, and licenses

· Transfer of documentation currently in process

· Transfer of previous project activities and log of support issues and incidents

· Workplace logistics and staffing plan

· Coordination of knowledge transfer sessions with the incumbent Contractor

The Transition-in Plan shall be approved by the ITPM and COR and describe the Contractor’s process for transitioning from the incumbent with no disruption in operational services.

6.2.2 Transition-Out Plan

The Contractor shall develop and submit a draft Transition-Out Plan, in MS Word format, within three (3) months before the completion of the period of performance of this contract, to the intended audience, including the Government ITPM, Product Owner(s), and the COR, to include the following technical activities that will be transferred to the successor:

· Inventory and orderly transfer of all hardware, software, and licenses

· Submit all contract deliverables to date, including designs, documents, briefings, reports, spreadsheets, and source code.

· Transfer of documentation currently in process

· Transfer of current project activities and log of Tier I, II, and III tickets issues and incidents

· Workplace logistics and staffing plan

· Coordination of knowledge transfer sessions with the successor Contractor

The Contractor shall fully support the transition of all Contract requirements to the successor to ensure no disruption in operational services.

6.3 Weekly Status Report

The contractor shall prepare a weekly status report, in MS Word format, due each Friday, by 1200 ET to the intended audience, including the Government Project Manager(s), Product Owner(s), and the COR. The weekly status report will include:

· Description of work accomplished (Accomplishments)

· Work planned for the following week (Planned Activities)

· Deviations from planned activities (changes in scope)

· Tier I, II, and III tickets (including open and closed calls/inquiries/issues) and risks (including remediation plan) summary log.

6.4 Monthly Status Report

The contractor shall prepare a monthly status report, in MS Word format, due each 5th day of the month or next following business day to the intended audience, including the Government Project Manager(s), Product Owner(s), and the COR. The monthly status report will present historical data, including:

· Cumulative description of work accomplished (Accomplishments)

· Cumulative work planned for the following week (Planned Activities)

· Cumulative Tier I, II, and III tickets (including open and closed calls/inquiries/issues) and risks summary log (including trend analysis by category/type)

· Performance metric data (monthly):

· Support desk incident count by incident category/type.

· Support desk incident summary report

· Total number of dental digital images generated by image category/type.

· Resource and financial monitoring, with burn rate chart (monthly):

· Invoice tracking

· Contract Line Item Number (CLIN)

· Planned budget, actuals, and the variance for each month through the contract completion.

· Cumulative performance against performance standards and associated metrics. See 7.0 Performance Standards.

6.5 After Action Report

After each Tier III support incident, the Contractor shall submit an After Action Report, in MS Word format, within 5 business days of a Tier III support incident, to the intended audience, including the Government Project Manager(s), Product Owner(s), and the COR. Documentation shall include details of the incident, reported by the primary IT POC and alternate IT POC, including the date and time of incident receipt, a description of the actions taken by the IT POCs to resolve the issue, and any recommendations for changes or enhancements to prevent the reoccurrence of the incident.

6.6 Support Troubleshooting Scripts

A set of scripts for solving and troubleshooting all commonly reported issues, including those escalated to Tier III, shall be submitted, in MS Word format, immediately after the contract is awarded, to the intended audience, including the Government Project Manager(s), Product Owner(s), and the COR.

As scripts are updated, especially following a Tier III support ticket, the Contractor shall submit the revised Service Desk Troubleshooting Scripts within 5 days of script change(s).

7.0 CONTRACTOR PERSONNEL

The Contractor shall identify a corporate representative as the contract point of contact (POC) for all work under this contract. The corporate representative shall have full authority to act for the Contractor on all contract matters relating to the daily operation of this Contract. An alternate shall also be designated, but the Contractor shall identify those times when the alternate shall be the primary POC.

The Government has determined that a Project Manager is the key personnel and could serve as the contract POC. It is expected that the Project Manager will select qualified persons for the IT POC and Alternate IT POC personnel, to be accepted by ICE.

The Contractor shall propose one (1) key personnel for this SOW who meets the required skills set below. Any certifications not obtained before award must be achieved within six (6) months of an individual Contractor’s EOD. The Government will schedule the NCIC certification training for key personnel requiring the certification. The Government expects that the project and/or activities will not be impacted by hour constraints, specifically for the key personnel. Key personnel must exhibit critical soft skills including:

· Excellent active listening and verbal communication skills

· Strong sense of collaboration, teamwork, and accountability

· Strong business writing ability

· Flexible and adaptable attitude

· Can conform to shifting priorities, demands, and timelines

· Ability to elicit cooperation from a wide variety of Stakeholders

· Possession of excellent client-facing consulting, leadership, and analytic skills

· Ability to discuss technical issues with non-technical, executive-level government officials

· Ability to communicate issues, status, tradeoffs, and priorities

· Leading and mentoring teams

7.1 Project Manager

The Project Manager (PM) will have overall responsibility for the contract activities: planning, organizing, directing, controlling, staffing, and reporting status, deliverables, and schedules to the Government.

Required Skills/Experience: Eight (8) or more years of relevant experience:

· Project Management Institute (PMI) Project Management Professional (PMP) certification

· Experience with requirements tools and tracking (e.g. JIRA, Version One)

· Experience conducting stand-up meetings, facilitating planning meetings, and coordinating performance reviews, retrospectives, and burn-down charts

· Experience defining all project activities and milestones required to meet objectives and deliverables, properly sequencing tasks and estimating effort with project team members doing the work, determining the critical path, and leveling the project schedule

· Experience monitoring program execution to identify obstacles and deviations from plan and take corrective action as needed

· Experience conducting continuous risk assessment and management including developing measures to reduce risk in program execution

· Experience developing metrics and reports for tracking program execution

· Experience with contract management, budgeting, and resource allocation, including management of subcontractor personnel

· Proficient in the development of plans, assigning tasks, monitoring performance, communicating progress, resolving conflicts, and escalating issues

· Experience with all aspects of configuration management planning including configuration identification, change control, configuration status accounting, configuration audits, configuration documentation

7.2 Key Personnel Substitutions

The identified Key Personnel is critical to performance under this SOW. During the period of performance, Key Personnel shall only be replaced with people who meet the position’s required specifications. The Contractor shall obtain approval from the Government before replacement of any Key Personnel. All substitutions shall be submitted in writing to the Contracting Officer (CO) for approval and to the COR for information.

No changes in Key Personnel will be made unless the Contractor can demonstrate that the qualifications of prospective replacement personnel meet or exceed the required qualifications specified for the position. The CO shall be notified in writing of any proposed substitution three (3) months in advance of the proposed substitution. Such notification shall include:

· An explanation of the circumstances necessitating the replacement

· A complete resume of the proposed substitute

· As requested by the CO or COR, any other information that will enable the CO to judge whether or not the Contractor meets or exceeds the contract’s minimum requirements specified for the key personnel position.

The CO and COR will evaluate Key Personnel substitutions and will promptly notify the Contractor of his/her approval or disapproval in writing. All disapprovals will require re-submission of another substitution to fill key positions within two (2) weeks.

8.0 PERFORMANCE STANDARDS

The following tables define the performance objectives and standards to be adhered to for the Tier III Support Services. The Contractor shall report performance against all performance standards and associated metrics by the 5th day of each month, or the following next business day, to be included with the Monthly Status Report.

The following Performance Standards table represents the quantitative and qualitative metrics by which performance will be measured with the corresponding service output for service level maintenance.

Performance Standards

9.0 GENERAL SECURITY REQUIREMENTS

9.1 PRELIMINARY FITNESS DETERMINATION

ICE will exercise full control over granting, denying, withholding or terminating unescorted government facility and/or sensitive Government information access for Contractor applicants/employees, based upon the results of a Fitness screening process. ICE may, as it deems appropriate, authorize and make a favorable expedited preliminary Fitness determination based on preliminary security checks. The preliminary Fitness determination will allow the Contractor employee to commence work temporarily prior to the completion of a Full Field Background Investigation. The granting of a favorable preliminary Fitness shall not be considered as assurance that a favorable final Fitness determination will follow as a result thereof. The granting of preliminary Fitness or final Fitness shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by ICE, at any time during the term of the contract. No employee of the Contractor shall be allowed to enter on duty and/or access sensitive information or systems without a favorable Fitness determination by the Office of Professional Responsibility (OPR), Personnel Security Division (PSD). No employee of the Contractor shall be allowed unescorted access to a Government facility without a favorable Fitness determination by OPR PSD. Contract employees are processed under DHS Instruction 121-01-007-001, Personnel Security, Suitability and Fitness Program, dated June 14, 2017, or successor thereto; those having direct contact with Detainees will also have 6 CFR § 115.117 considerations made as part of the Fitness screening process. Sexual Abuse and Assault Prevention Standards implemented pursuant to Public Law 108-79 (Prison Rape Elimination Act (PREA) of 2003)).

9.